BeyondTrust on Oct. 15 confirmed that a zero-day flaw in its BeyondTrust Remote Support appliances were exploited by the China-linked threat group Armory Castle.
Security pros were concerned about the attack because it comes on the heels of multiple exploits by the Chinese nation-state group over the past few weeks.
Armory Castle is also tied to the recent wave of Citrix NetScaler attacks, and exploits of Ivanti Secure Connect appliances. Armory Castle was also behind the exploits of Dell Recover Point for Virutal Machine devices reported last February, attacks that date back to mid-2024.
The CVSS 9.3 in the BeyondTrust case — CVE-2026-102764 — could under the right conditions let attackers perform file operations on the BeyondTrust appliances. Patches were released to all Remote Support SaaS customers Oct. 9. Self-hosted customers running Remote Support version 24.3.1 through 26.2.3 were advised to update manually, while customers running a version older than 24.3.1 must upgrade to a newer version.
According to research by Mandiant and the Google Threat Intelligence Group (GTIG), Armory Castle continues to prioritize zero-day vulnerabilities in edge devices to conduct long-term espionage. The GTIG researchers said Armory Castle and other threat actors have historically conducted broad, opportunistic exploitation once a vulnerability becomes public, racing to infiltrate organizations before defenders can patch.
Here's a summary of Google/Mandiant’s top findings:
- Attack chain and root access: Armory Castle exploited a zero-day vulnerability in BeyondTrust Remote Support to gain initial access and escalated privileges to achieve root-level control of the BeyondTrust device.
- Custom malware and espionage tooling: Armory Castle deployed custom backdoors, such as the SAWFLY webshell and BARECLAW tunneler, to maintain persistent, stealthy access.
- Credential harvesting and reconnaissance data theft: The threat actor leveraged the appliance’s native administrative capabilities for credential harvesting and lateral movement to exfiltrate sensitive reconnaissance data from the internal network.
“Armory Castle is a prime example of why edge and remote access technology remains some of the most valuable targets for nation-state operators,” said Justin Moore, director of adversary operations at Arctic Wolf. “They sit at the boundary of the enterprise while holding privileged access to what lies behind it. Exploiting an unknown vulnerability gave them a valuable head start, but the impact came from administrative control, credential harvesting, persistent access, and the ability to reach downstream systems through trusted remote-support functions.”
Erin Whitmore, head of Blackpoint Cyber’s adversary pursuit group, explained that nation-state attributed campaigns like this are inherently different from standard cybercriminal attacks in their motivations and impact. Unlike cybercriminal groups, Whitmore said nation-state groups like Armory Castle tend to focus more on espionage and intelligence gathering where the ultimate target or end goal is not always clear.
“These groups tend to be heavily resourced and deeply capable in both their knowledge of vulnerability exploitation and zero-day discovery where the objective is often to gather credentials, gain footholds in networks, move laterally, and daisy chain to other victims with the intent to steal non-public information in advance of their governments' objectives,” said Whitmore. “These groups remain some of the most sophisticated and hardest to detect because their focus is to remain quiet in pursuit of their intelligence collection objectives. Attribution can be very difficult due to their infrastructure and techniques usage. Regardless, the defense mechanisms remain concretely the same for nation state and criminal activity alike and are rooted in best security practices.”
Whitmore was mostly concerned with the level of access BeyondTrust Remote Support holds within an organization: the appliance has privileged access to systems across an organization’s environment; for service providers that extends to downstream customers.
“A threat actor that exploits this vulnerability can gain administrative control of the appliance, which can expose sensitive credentials and open a pathway to other systems,” said Whitmore. “From there, threat actors can move to other parts of a compromised network, so the risk reaches well past the one vulnerable appliance.”
John Strand, owner of Black Hills Information Security, pointed out that when attackers gain access to remote monitoring and management tools, they may have access to dozens, hundreds, or even thousands of organizations through that one compromise.
“That’s a tremendous amount of reach,” said Strand. “I almost wish CISA or somebody in government would designate these software platforms as critical infrastructure, because they are absolutely remote gateways into a tremendous amount of critical infrastructure across the United States today. We need to start treating them that way.”
